Lucene search

[email protected]CVE-2016-9889

HistoryDec 23, 2016 - 5:59 a.m.

CVE-2016-9889

2016-12-2305:59:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2016-9889

tiki wiki

cms

xss

vulnerability

security

nvd

parameter

input sanitized

geo_zoomlevel_to_found_location

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.7%

JSON

Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don’t have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.

Affected configurations

NVD

Node

tikitikiwiki_cms\/groupwareMatch12.0

tikitikiwiki_cms\/groupwareMatch12.1

tikitikiwiki_cms\/groupwareMatch12.2

tikitikiwiki_cms\/groupwareMatch12.3

tikitikiwiki_cms\/groupwareMatch12.4

tikitikiwiki_cms\/groupwareMatch12.5

tikitikiwiki_cms\/groupwareMatch12.6

tikitikiwiki_cms\/groupwareMatch12.7

tikitikiwiki_cms\/groupwareMatch12.8

tikitikiwiki_cms\/groupwareMatch12.9lts

tikitikiwiki_cms\/groupwareMatch15.0

tikitikiwiki_cms\/groupwareMatch15.1

tikitikiwiki_cms\/groupwareMatch15.2

tikitikiwiki_cms\/groupwareMatch16.0

CPENameOperatorVersion
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.0
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.1
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.2
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.3
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.4
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.5
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.6
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.7
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.8
tiki:tikiwiki_cms\/groupwaretiki tikiwiki cms/groupwareeq12.9

CPE	Name	Operator	Version
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.0
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.1
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.2
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.3
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.4
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.5
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.6
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.7
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.8
tiki:tikiwiki_cms\/groupware	tiki tikiwiki cms/groupware	eq	12.9

Rows per page:

1-10 of 141

References

www.securityfocus.com/bid/95083

www.securitytracker.com/id/1037531

tiki.org/article443-Security-update-Tiki-16-1-Tiki-15-3-and-Tiki-12-10-released

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.7%

JSON

Related for CVE-2016-9889

cvelist1 nvd1 prion1